In a system which controls a current of a motor by causing an inverter to invert an output from a DC power source to an AC voltage and applying the AC voltage to the motor, a necessary voltage command value is calculated by using a computation device such as a microcomputer. The voltage command value from the microcomputer is generally sent to a circuit which controls switching of semiconductor elements such as insulated gate bipolar transistors (IGBT) which are disposed between the DC power source and the motor, as a PWM signal, and thus, a voltage corresponding to the voltage command value is applied to the motor.
A current to be flowing in the motor is determined as a current command value based on the torque to be output from the motor, and the torque to be output is determined as a torque command value by the microcomputer or an external device.
The microcomputer has a plurality of functions such as a function which is necessary when performing computation of the current command value, acquisition of a current value, computation of the voltage command value in order to cause the current of the motor to coincide with the current command value, and outputting of the PWM signal. If any function among thereof becomes abnormal, an abnormality occurs in the function related to controlling of a current. When an abnormality occurs, an unexpected voltage command is applied to the motor and the motor outputs unexpected excessive torque depending on the circumstances, thereby causing a possibility that a negative influence is applied to the outside. Therefore, there is a need to detect the occurrence of an abnormality and to stop applying the voltage to the motor so as to prevent an output of unexpected excessive torque.
For example, in a case where the motor is a drive motor of a vehicle, an abnormality occurs in the computation device. Therefore, there is a need to prevent the motor from outputting torque having a torque command value different from a value sent to the microcomputer from the external device which controls the vehicle system. Particularly, there is a need to prevent excessive torque which is output by the motor and is not expected by a driver.
As a technology for detecting an abnormality of the microcomputer, there are known examples such as an example in which the microcomputer diagnoses abnormality of itself (hereinafter, referred to as a self-diagnosis) and an example in which an abnormality of the microcomputer is diagnosed by a monitoring device other than the microcomputer. Particularly, an objective of the diagnosis made by the monitoring device is to detect an abnormality of the microcomputer even when the microcomputer becomes abnormal and a normal self-diagnosis cannot be made by the microcomputer.
When a result of the self-diagnosis made by the microcomputer indicates abnormality, it is clear that some type of abnormality has occurred in the microcomputer. Therefore, there is a need to stop applying a voltage to the motor. Meanwhile, when a diagnostic result obtained by the monitoring device indicates abnormality, there are a case where the microcomputer is actually abnormal and a case where some type of abnormality has occurred in the monitoring device or in the peripheral circuit thereof.
In the example in which an abnormality of the microcomputer is diagnosed by the monitoring device, if the microcomputer is normal, a current can be continuously controlled by the microcomputer even when an abnormality has occurred in the monitoring device or in the peripheral circuit thereof.
For example, it is possible to consider a case of utilizing a known technique in which the monitoring device receives a signal sent from the microcomputer and the monitoring device executes a diagnosis for the microcomputer. In this example, even though the microcomputer on a side transmitting a signal is normal, if the receiving performance of the monitoring device is abnormal or an abnormality occurs in the circuit used for communication, the diagnostic result obtained by the monitoring device indicates abnormality, as a result.
In this case, when the diagnostic result obtained by the monitoring device indicates abnormality, it is difficult to judge whether the microcomputer is abnormal, or the monitoring device or a portion other than thereof is abnormal. Therefore, according to the example in the related art, the voltage has been stopped from being applied to the motor in order to prevent the possibility of an occurrence of unexpected excessive torque.
In this regard, there is a known technology in which after a sub CPU detects an abnormality of a main CPU, the sub CPU stops the operation of an actuator system by blocking power supplied to the main CPU (for example, refer to PTL 1).
Meanwhile, there is another known technology in which a plurality of the CPUs (three or more CPUs) are caused to monitor each other and the CPU having an abnormality is specified so as to cause the remaining CPU with no abnormality to continue the computation (for example, refer to PTL 2).